
where the superscript for \(f_{\theta }\)  indexes its elements, i.e., the output logits. Solving eq:mindistort produces not only a minimally distorted perturbation \(x^{\prime }\)  but also a robustness radius, making it another popular choice for RE [1]}, [2]}. For small and restricted \(f_{\theta }\)  and selected \(d\) , eq:mindistort can be solved exactly by mixed integer programming [3]}, [4]}, [5]}. For general \(f_{\theta }\)  and selected \(d\) , lower bounds of the robustness radius can be computed [6]}, [7]}, [8]}, [9]}. But in general, eq:mindistort is heuristically solved via gradient-based methods or iterative linearization [10]}, [11]}, [12]}, [13]}, [14]}, [1]}, [16]}.
